The Single-Packet Attack: Making Remote Race Conditions Local
PortSwigger Research introduces the single-packet attack, a novel technique for exploiting web race conditions by eliminating network jitter. This method completes multiple HTTP/2 requests within a single TCP packet, ensuring they are processed simultaneously on the server. By combining 'last byte sync' and 'timeless timing attack' strategies, the technique makes remote race condition exploitation as reliable as local testing. The approach scales to handle 20-30 requests and is integrated into tools like Burp Suite and Turbo Intruder. The article further explores the applicability of this attack across other protocols, including HTTP/3, HTTP/1.1, WebSockets, and SMTP. While HTTP/3 supports the technique via UDP datagrams, limitations in packet size make it less practical than optimizing HTTP/2 implementations. HTTP/1.1 can utilize pipelining to achieve similar results. This research provides security professionals with guidelines to adapt the attack for various protocols, significantly enhancing the detection and exploitation of timing vulnerabilities in web applications.
Wire timeline
The Single-Packet Attack: Making Remote Race Conditions Local
PortSwigger Research introduces the single-packet attack, a novel technique for exploiting web race conditions by eliminating network jitter. This method completes multiple HTTP/2 requests within a single TCP packet, ensuring they are processed simultaneously on the server. By combining 'last byte sync' and 'timeless timing attack' strategies, the technique makes remote race condition exploitation as reliable as local testing. The approach scales to handle 20-30 requests and is integrated into tools like Burp Suite and Turbo Intruder. The article further explores the applicability of this attack across other protocols, including HTTP/3, HTTP/1.1, WebSockets, and SMTP. While HTTP/3 supports the technique via UDP datagrams, limitations in packet size make it less practical than optimizing HTTP/2 implementations. HTTP/1.1 can utilize pipelining to achieve similar results. This research provides security professionals with guidelines to adapt the attack for various protocols, significantly enhancing the detection and exploitation of timing vulnerabilities in web applications.
PortSwigger Research